[Bug] Anthropic API Security Classifier False Positive on Steganographic Research Implementation

Subject: Blocking by the security classifier during a session - Claude Code (StegoShard project)

Background
I maintain StegoShard, an open-source encrypted backup tool. It breaks an encrypted secret into fragments and hides them in ordinary photos (JPEG steganography), so that a user can keep their own data discreetly and resiliently. The project has a documented public specification (SPEC.md), threat model, and cryptographic review. It also includes a reference implementation in Python.

The session began with a complete code review of the project, followed by four sets of patches (PR #201 to #204): MCP security, data loss, robustness against forged files, and SPEC compliance.

What was requested
I requested a plan to move JPEG insertion from a non-adaptive to an adaptive scheme. The techniques have been published for over ten years: STC codes (Filler, Judas, and Fridrich, 2011), and then a cost function (UERD). My explicit instructions were:

• no optimization against a custom detector;
• cite the sources rather than reinventing the primitives;
• maintain backward compatibility and determinism.

I approved the plan and then requested its step-by-step execution.

• Step 0: a test bench on my own corpus of photos, with classic published attacks (chi-square, calibration). Merged, PR #207.
• Step 1: STC coding, which reduces the number of modifications per photo by approximately 3.5×. Merged, PR #208.
• Step 2: ensure that each change ±1 has a direction determined by the key rather than imposed by parity. This is the approved plan step (the transition from LSB replacement to LSB matching),

and it was during its execution that the deadlock occurred.

What triggered the blockage?
The classifier doesn't indicate the cause. The interrupted response followed the execution of the step 2 measurement bench. It presented the measurements of this new variant (number of modifications, transitions between magnitudes, steganalysis attack scores) and compared them to the previous steps, just as it did to steps 0 and 1, which had not been blocked.

After the blockage, Claude stopped this work. It refused to resume it when I indicated that it was a false alarm.

Why I think it's a false alarm:

• This is about protecting the user's own data, in a documented open-source project.
• The techniques are public and published in academic literature.
• The work followed an approved plan, with measurements used to honestly document the threat model, not to circumvent a third-party detection system.